Remote Desktop Manager EUVD-2026-65063

The attacker must achieve an on-path network position between the Remote Desktop Manager client and the VNC server - for example via ARP poisoning on a shared LAN, DNS spoofing, or operating a rogue wireless access point. The victim user must actively initiate a VNC connection using the IronVNC client with RSA-AES authentication selected (UI:R in CVSS). The vulnerability is specific to the IronVNC client component; other connection protocols within RDM are not confirmed affected. Exploitation is bounded to the 2026.2.x branch at or below 2026.2.17.0 and the 2026.1.x branch at or below 2026.1.24.0. On well-segmented enterprise networks where VNC traffic is confined to trusted VLANs, the on-path prerequisite is a meaningful barrier. The primary limiting factors are the need for active user interaction and physical or logical network adjacency.

The vendor-assigned CVSS 4.3 (Medium) reflects AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, but several signals warrant scrutiny. AC:L understates the real-world prerequisite: on-path positioning via ARP spoofing, DNS poisoning, or rogue access point is not a low-complexity primitive for opportunistic attackers, which would push complexity higher. More notably, C:N (no confidentiality impact) appears inconsistent with a MITM on VNC - an attacker relaying the session can observe screen content and keystrokes, suggesting at least C:L is warranted. EPSS at 0.11% (1st percentile) confirms no observed exploitation activity, and the absence of a CISA KEV listing corroborates that exploitation is not confirmed in the wild. No POC is publicly identified. Real-world priority is low for well-segmented enterprise environments but elevated for users connecting to VNC servers over shared or untrusted networks. The CVSS C:N rating is inferred from the provided vector; it conflicts with the practical impact of MITM on an interactive remote desktop session and should be verified with Devolutions.

An attacker on the same network segment as the RDM user - whether via ARP spoofing, a rogue access point, or physical adjacency - intercepts a VNC connection initiated through the IronVNC client. Because the client automatically accepts the presented RSA key without verification, the attacker inserts their own keypair into the handshake, establishing a relay position where they can observe session content and inject modified inputs. No public POC exists, but the technique requires only standard MITM tooling and network access, not exploitation of memory corruption or complex race conditions.